mailing list archives
[PEN-TEST] Hard-coded passwords in WINNT directory?
From: Jonathan Wrathall <JWrathall () JAWZINC COM>
Date: Mon, 27 Nov 2000 15:23:42 -0700
During a test of a client's IIS web server, I've encountered the following
1. I am able to view files in the WINNT directory using the "MS Index
Server '%20' ASP Source Disclosure Vulnerability" vulnerability.
2. I am able to connect to IPC$, and I've used dumpsec to get the userlist
3. The winnt/system32/repair/sam._ file does not appear to be present.
Can anyone suggest other files that might reveal hard-coded passwords, or
other valuable information?
Jonathan Wrathall, BCom
- [PEN-TEST] Hard-coded passwords in WINNT directory? Jonathan Wrathall (Nov 28)